DPIA template for clinics
Last updated 31 October 2026 · Version 2026-10-31
A starting point for your clinic's data protection impact assessment, with the parts Hizmedia Ltd handles for you in Drawn already filled in.
How to use this template
Your clinic processes patients' health data, so UK GDPR requires a data protection impact assessment (DPIA) before you start. This template follows the ICO's DPIA structure. The parts Drawn handles are filled in for you. Copy it into your own document, answer each Your clinic prompt, and keep it with your records. Review it every year, or when how you work changes.
The ICO's own guidance and template are at ico.org.uk.
Why a DPIA is needed
You process special category health data: the tests patients book and their results. Processing health data on a large scale is likely to be high risk, so a DPIA is required.
Your clinic: roughly how many patients a year, and whether you see children.
The processing
What Drawn does for you
- Patients book online at your booking page, or on your website through the embedded form.
- Your staff manage appointments, and your clinicians upload test reports, which patients see once released.
- Drawn emails booking confirmations, reminders and results-ready notices, and can take payment through your own Stripe account.
- Drawn holds patients' name, email, phone, home address for home visits, bookings, tests booked, consents, payments and invoices, and reports with comments. Date of birth only if you turn it on.
- Drawn runs in London, its database is in London, and reports are stored in Sweden. The companies Drawn uses are on the sub-processors page.
What you decide
Your clinic: which tests and places you offer, who on your team has which role, which staff can see reports, whether you collect dates of birth and why, whether you take payment online, and your retention periods in Settings > Privacy notice.
Your clinic: anything you do with patient data outside Drawn, such as sending samples to a lab, and what the lab receives.
Consultation
Your clinic: who you've consulted: your clinicians, your data protection lead if you have one, and how you take account of patients' views, for example through feedback or complaints.
Necessity and proportionality
- Lawful basis: usually contract with the patient, and for health data Article 9(2)(h), the provision of health care, with the conditions in the Data Protection Act 2018.
- Minimisation in Drawn: date of birth is off unless you give a reason, address is asked only for home visits, messages don't name tests unless you turn that on, and payment links never send test names to Stripe.
- Retention: Drawn deletes records every night past your periods. Cancelled bookings go after 30 days.
- Patients' rights: your admins can export, correct, restrict, stop marketing for, and erase a patient's record.
Your clinic: your lawful basis and Article 9 condition, and how your privacy notice explains them to patients.
Your clinic: the retention periods you've chosen, and why they fit your clinic.
Risks, and what reduces them
| Risk | What Drawn does | What you do |
|---|---|---|
| Staff accounts taken over | 12-character passwords, a code by email on every sign-in, 8-hour sessions, rate limiting | Give each person their own account, secure staff email accounts, turn off leavers straight away |
| Too many staff see results | Reports are visible only to clinicians and staff given access with a reason | Review who has report access, and why |
| A patient sees someone else's results | Patients sign in with a code to their own email, and see reports only once released | Check the right report is uploaded to the right patient before releasing it |
| Messages reveal what someone was tested for | Test names are left out of messages by default | Leave that setting off unless you have a reason |
| Another clinic sees your data | Each clinic's data is separated by the database itself | Nothing |
| Data kept too long | Deleted every night past your periods | Set periods that fit your clinic |
| A breach at Drawn | Encryption in transit and at rest, an audit log, and a promise to tell you within 48 hours | Report to the ICO within 72 hours where needed, and tell patients if the risk is high |
Your clinic: any other risks in how your clinic works, how likely and how serious each is, and what you do about them.
Sign-off
Your clinic: who approved the measures, who accepted the risk that's left, and the date. If a high risk remains, you must consult the ICO before you start.
Questions about Drawn's part: director@hizmedia.com. This template supports our data processing agreement.
Questions about this document? Email director@hizmedia.com. Drawn is a product of Hizmedia Ltd.